Malicious PDF — malware analysis report

Static analysis result for SHA-256 b108ec6e55e46899…

MALICIOUS

PDF

41.6 KB Created: 2020-09-18 16:42:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e2c440c1099938929eec72868e4b0e8f SHA-1: ca902cfe7227f5137b6e6c7cf1ceeccc2397ee73 SHA-256: b108ec6e55e4689903fa6f00813e80823a0f0064d11f647ca8f73bd3990477ee
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass of external links, including a critical link to a known malicious redirector at https://ttraff.me/pify?keyword=stainless+steel+percolator+made+in+usa. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains references to the redirector URL and other PDF files, suggesting a link farm or redirection scheme designed to lead users to malicious content. No scripts were extracted, but the PDF structure itself is the delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/pify?keyword=stainless+steel+percolator+made+in+usa
    • http://zefumom.oaklandmillsonline.com/uploads/1/3/0/8/130873916/e3e6ab.pdf
    • http://jubafuwef.beaumontnurses.org/uploads/1/3/0/9/130969430/detun-nivajakumamo.pdf
    • http://files.joelfeske.com/uploads/1/3/0/7/130739831/jixapenapomu.pdf
    • http://files.lindentreeherbals.com/uploads/1/3/0/7/130775221/jazexuvuwigo.pdf
    • https://5d6f5651-f14d-4829-b23f-0cd19bacf498.filesusr.com/ugd/a7074a_e69945ab286b4dfba9cad30aecb0a1cf.pdf?index=true
    • https://d1018736-097c-4191-9ee3-7170019cb1b9.filesusr.com/ugd/faa7ef_1f906312f9724f21917d7c40a4e026b0.pdf?index=true
    • https://51cd38e4-e7e3-41dc-9a1d-0f6edc81d077.filesusr.com/ugd/faa7ef_b254567a0e5d487bb042e2f9f78a7bce.pdf?index=true
    • https://9bb2f78d-5b17-434a-9922-1fb3e9d48bd3.filesusr.com/ugd/3f4b99_73c477a6751c4cc0a319f7ffd3ec9c18.pdf?index=true
    • https://426c8a8c-f47e-419b-8e09-9c3d74d0a594.filesusr.com/ugd/ace02d_9f7d0a8d76ab44b8a6aec92221eea038.pdf?index=true
    • https://486bd222-1071-480d-afa3-de54bd4504d8.filesusr.com/ugd/822ecd_40375555d66f4b3e9ae140ee63079827.pdf?index=true
    • https://f3057827-738b-49ee-bbd7-13bfd665530a.filesusr.com/ugd/d4579c_d8329413cd7d4cd8b72e844c17a34c9f.pdf?index=true
    • https://de5b41f0-e017-4a1b-a950-d02260105226.filesusr.com/ugd/e4d7df_c66476b2003c428cb47016fb91f1eb77.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006434.bin
ba688ddf9d96c7ac3d4813ae7c192d99cd5adbdf867d4b39ff0d9baa3a77412c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6434 5324 bytes
font_01_sfnt_off00007631.bin
e5ed05fee8b6dcaa04a2132b20415b83a4e2269b90d5911ca5512c520b6acd21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7631 10352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.